Input Leap (Product): news timeline & CVEs

[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

Input Leap through 3.0.3 lets a local Windows user run commands as SYSTEM via unauthenticated IPC.

NotCVE-2026-0015 describes missing authentication for a critical function in the input-leapd daemon of Input Leap through version 3.0.3. On Windows, a local low-privileged user can use the unauthenticated IPC interface to execute arbitrary commands as NT AUTHORITY\SYSTEM. The advisory does not assign a CVE or report exploitation in the wild.

Full Disclosure04:11 UTC · 4h agoVulnerability 4 sources

[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory

Input Leap 3.0.3 path traversal lets a connected peer write files outside the drop directory.

NotCVE-2026-0014 covers improper pathname limitation in Input Leap 3.0.3's drag-and-drop file transfer. A connected peer can write a file outside the configured drop-target directory. The advisory does not cite a CVE or say the issue is being exploited.

Full Disclosure04:11 UTC · 4h agoVulnerability 4 sources

[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

Input Leap through 3.0.3 lets a local Windows user run commands as SYSTEM via unauthenticated IPC.

An oss-security advisory labeled NotCVE-2026-0015 says Input Leap through version 3.0.3 lacks authentication on a critical function in the input-leapd daemon. A local, low-privileged Windows user can use that unauthenticated IPC interface to execute arbitrary commands as NT AUTHORITY\SYSTEM. The notice describes a local privilege escalation and does not report observed exploitation or assign a standard CVE identifier.

oss-securityupdated 04:11 UTC · 4h agofirst Sep 25, 19:03 UTC · 1d agoVulnerability 4 sources

[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory

Input Leap 3.0.3 lets a connected peer write files outside the drag-and-drop directory via path traversal.

An oss-security advisory labeled NotCVE-2026-0014 describes a path traversal in Input Leap 3.0.3's drag-and-drop file transfer. Improper pathname limits let a connected peer write a file outside the configured drop-target directory. The published excerpt does not mention a patch, a standard CVE assignment, or observed exploitation.

oss-securityupdated 04:11 UTC · 4h agofirst Sep 25, 09:13 UTC · 1d agoVulnerability 4 sources

Input Leap

Timeline4 articles

Appears with

[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory

[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM

[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory